CVE-2026-15702

MEDIUM

tamagui config.ts updateConfig prototype pollution

Title source: cna
STIX 2.1

Description

A security vulnerability has been detected in tamagui up to 2.3.0. This affects the function updateConfig of the file code/core/web/src/config.ts. Such manipulation leads to improperly controlled modification of object prototype attributes. The attack may be performed from remote. Upgrading to version 2.3.1 is able to mitigate this issue. The name of the patch is e46af9879b7627934ea4d6d6e46e65cea53abb3d. The affected component should be upgraded.

References (8)

Core 8
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-378249 | tamagui config.ts updateConfig prototype pollution
https://vuldb.com/vuln/378249
Signature, Permissions Required signature permissions-required
VDB-378249 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/378249/cti
Third Party Advisory third-party-advisory
CVE-2026-15702 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-15702
Third Party Advisory third-party-advisory
Submit #856138 | Node.js @tamagui/web 2.2.0 Prototype Pollution
https://vuldb.com/submit/856138
Issue Tracking issue-tracking
https://github.com/tamagui/tamagui/issues/4029

Scores

CVSS v3 6.3
EPSS 0.0034
EPSS Percentile 26.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-1321 CWE-94
Status published
Products (5)
None/tamagui 2.0
None/tamagui 2.1
None/tamagui 2.2
None/tamagui 2.3.0
None/tamagui 2.3.1
Published Jul 14, 2026
Tracked Since Jul 14, 2026